Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual page 721

Chapter 42 Configuring IEEE 802.1X Port-Based Authentication
•
•
The combination of the IP address and UDP port number creates a unique identifier, which enables
RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different
host entries on the same RADIUS server are configured for the same service (for example,
authentication) the second host entry configured acts as the failover backup to the first one. The RADIUS
host entries are tried in the order that they were configured.
To configure the RADIUS server parameters, perform this task:
Command
Step 1
Router(config)# ip radius source-interface
interface_name
Router(config)# no ip radius source-interface
Step 2
Router(config)# radius-server host {hostname |
ip_address}
Router(config)# no radius-server host {hostname |
ip_address}
Step 3
Router(config)# radius-server key string
Step 4
Router(config)# end
When you configure the RADIUS server parameters, note the following information:
•
•
•
•
•
OL-11439-03
Host name and specific UDP port numbers
IP address and specific UDP port numbers
For hostname or ip_address, specify the host name or IP address of the remote RADIUS server.
Specify the key string on a separate command line.
For key string, specify the authentication and encryption key used between the switch and the
RADIUS daemon running on the RADIUS server. The key is a text string that must match the
encryption key used on the RADIUS server.
When you specify the key string, spaces within and at the end of the key are used. If you use spaces
in the key, do not enclose the key in quotation marks unless the quotation marks are part of the key.
This key must match the encryption used on the RADIUS daemon.
You can globally configure the timeout, retransmission, and encryption key values for all RADIUS
servers by using the radius-server host global configuration command. If you want to configure
these options on a per-server basis, use the radius-server timeout, radius-server retransmit, and
the radius-server key global configuration commands. For more information, refer to the Cisco IOS
Security Configuration Guide, Release 12.2, publication and the Cisco IOS Security Command
Reference, Release 12.2, publication at this URL:
http://www.cisco.com/en/US/docs/ios/12_2/security/command/reference/fsecur_r.html
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
Configuring 802.1X Port-Based Authentication
Purpose
Specifies that the RADIUS packets have the IP address of
the indicated interface.
Prevents the RADIUS packets from having the IP address
of the previously indicated interface.
Configures the RADIUS server host name or IP address
on the switch.
If you want to use multiple RADIUS servers, reenter this
command.
Deletes the specified RADIUS server.
Configures the authorization and encryption key used
between the switch and the RADIUS daemon running on
the RADIUS server.
Returns to privileged EXEC mode.
42-9